The GSM SIM cards, by design, can be remotely updated to do whatever the service provider wants (or asked "nicely", or paid to do).

https://www.thalesgroup.com/en/markets/digital-identity-and-...

I know, and they can be hacked too through sms messages.

But the sim card doesn't have access to the car telemetry. Probably even the whole baseband module doesn't. It just gets that data to transmit when an accident happens.

The worst you could do by hacking the SIM is to make the modem send nearby cell data somewhere. Which is serious enough because the rough location can be derived from it. But it's a far cry from what these manufacturers collect.

Or if the service provider is served a warrant, or if they're hacked.

Ecall could/should use completely separate communications infrastructure than the entertainment/vehicle connectivity functionality.

That's difficult because both will need to use the cell network.

But I guess you mean on the car side like two modems? Yeah that would be nice, or at least to mandate the option to turn all manufacturer telemetry completely off. The EU never bothered to do this for computers and phones either though.